From 0b73bc29f2ee7f71599a213bd52c03a42a65c00b Mon Sep 17 00:00:00 2001 From: Charles Treatman Date: Thu, 1 Oct 2026 14:26:37 -0500 Subject: [PATCH] ci: push release tags with the automation token actions/checkout persists GITHUB_TOKEN as an http.extraheader, and git sends that header instead of the credentials in the tag push URL. The v0.33.0 tag was therefore pushed with GITHUB_TOKEN, and pushes made with GITHUB_TOKEN don't trigger other workflows, so release.yml never ran. Don't persist credentials on checkout, so the tag push authenticates with PULUMI_PROVIDER_AUTOMATION_TOKEN. semantic-release builds its own authenticated URL from GITHUB_TOKEN, so it doesn't need them. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/equinix-tag-release.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/equinix-tag-release.yml b/.github/workflows/equinix-tag-release.yml index dd1be3cb1..3ad579a5b 100644 --- a/.github/workflows/equinix-tag-release.yml +++ b/.github/workflows/equinix-tag-release.yml @@ -22,10 +22,14 @@ jobs: if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) runs-on: ubuntu-latest steps: + # Don't persist GITHUB_TOKEN: checkout stores it as an http.extraheader, which git sends + # instead of the credentials in the tag push URL, and tags pushed with GITHUB_TOKEN don't + # trigger other workflows. semantic-release authenticates with GITHUB_TOKEN from its env. - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: fetch-depth: 0 + persist-credentials: false # Dry run only: a full run would also create the GitHub release, which the ci-mgmt # publish workflow creates once the tag is pushed.